Enterprise Account Manager - SLED

BeyondTrust patches zero-day exploited in attacks since August. BeyondTrust warned customers on Thursday to patch a critical flaw in its Remote Support (RS) that has been exploited in zero-day attacks since late August. Remote Support is the company's enterprise-grade support solution that helps IT service desks, help desks, and customer support teams troubleshoot issues remotely. Tracked as CVE-2026-102764, this actively exploited authentication bypass vulnerability lets unprivileged remote attackers perform file operations on unpatched appliances and affects RS 26.2.3 or earlier. BeyondTrust patched the security issue for all Remote Support and Privileged Remote Access SaaS customers on October 8, but self-hosted installations must be patched manually if automatic updates are not enabled. While the company shared limited details about the vulnerability, it said the zero-day was abused in the wild by a suspected China-nexus espionage actor tracked by Mandiant and Google Threat Intelligence Group (GTIG) security researchers as "Armory Castle" (formerly UNC5221) and by cybersecurity firm CrowdStrike as "Warp Panda." According to Mandiant researchers, who spotted the initial attacks, Armory Castle hackers exploited the flaw to gain initial access and escalated to root privileges on compromised devices by enabling Set User ID (SUID) permissions. Next, they deployed new Sawfly web shell and Bareclaw tunneler malware, wiped logs to evade detection, and moved laterally through the victim's network using compromised Administrator credentials by opening remote sessions on downstream systems. "After establishing a foothold through the web shell, the actor elevated from the web service account to root-level control of the appliance host. This gave them access to every credential the appliance stored or brokered and the ability to modify files that survive reboot and configuration reset," Mandiant said. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed." Internet threat watchdog Shadowserver tracks over 1,400 BeyondTrust remote support instances exposed online, but it provides no information on how many have already been secured or are honeypots. Armory Castle is known for targeting zero-day vulnerabilities in network edge appliances, including various Citrix NetScaler (CVE-2023-4966) and Ivanti Connect Secure (CVE-2023-46805 and CVE-2024-21887, then CVE-2025-0282) appliances, since at least October 2023 to breach enterprise networks and drop new custom malware. Threat intelligence company Volexity also said in January 2024 that UNC5221 had backdoored more than 2,100 Ivanti appliances using the GiftedVisitor webshell in attacks chaining the CVE-2023-46805 and CVE-2024-21887 zero-days. "In past campaigns, ARMORY CASTLE has conducted widespread and opportunistic exploitation following the public disclosure of vulnerabilities it had exploited selectively as zero-days, racing to infiltrate target organizations before patches are deployed," Mandiant added. "It is possible that we will observe similar widespread exploitation attempts associated with CVE-2026-102764." CVE-2026-102764 is the latest in a string of other BeyondTrust flaws that threat actors have exploited in the wild in recent years. Most recently, attackers exploited another critical remote code execution vulnerability (CVE-2026-1731) affecting Remote Support and Privileged Remote Access appliances to establish WebSocket channels and deploy ransomware. The Chinese state-backed Silk Typhoon hacking group is also believed to have exploited two zero-days (CVE-2024-12356 and CVE-2024-12686) to breach BeyondTrust's systems and use a stolen API key to compromise 17 Remote Support SaaS instances, including the U.S. Treasury Department's instance. In the same campaign, Silk Typhoon has also targeted the Office of Foreign Assets Control (OFAC), which administers U.S. sanctions programs, and the Committee on Foreign Investment in the United States (CFIUS), which reviews foreign investments for national security risks. BeyondTrust provides identity security services to over 20,000 customers worldwide, including government agencies and 75% of Fortune 100 companies.

Zero-Day in BeyondTrust Remote Support appliances exploited. 'Patch ASAP' Before Fix Gets Reverse-Engineered by Other Attackers, Expert Warns Mathew J. Schwartz (euroinfosec) - October 16, 2026 All organizations that use BeyondTrust Remote Support appliances are being urged to immediately install a security update in the wake of in-the-wild attacks. BeyondTrust on Thursday detailed a fix for BeyondTrust Remote Support - formerly known as Bomgar - appliances, used by IT teams to remotely manage endpoints, that it first released on Oct. 8. The Atlanta vendor warned all organizations running self-hosted Remote Support appliances to "immediately" install the fix for the critical vulnerability, tracked as CVE-2026-102764, which can be remotely exploited in all versions of Remote Support up to 26.2.3. The advisory also covers users of Privileged Remote Access appliances, which runs on the same vulnerable code. BeyondTrust said it has no evidence that hackers are attacking its other product, but "out of an abundance of caution, we have released the patch for PRA and recommend self-hosted Privileged Remote Access customers apply it immediately." BeyondTrust said the hackers have used the zero-day vulnerability to attack Remote Support appliances since August. The hacks have the hallmarks of a Chinese government-nexus threat actor tracked as Armory Castle and Warp Panda, and previously as UNC5221. "The actor uses a zero-day selectively against chosen targets, and once the vulnerability is public, the actor typically moves to broad exploitation of every instance still unpatched," it said. "The vulnerability exists within internal components of Remote Support. The components did not adequately validate the origin of the messages it received. Under the right conditions, this could be used to perform file operations on the appliance," the vendor said. BeyondTrust said it patched all SaaS customer instances of both Remote Support and Privileged Remote Access, which it manages, on Oct. 8. In a coordinated vulnerability report, threat intelligence researchers at Google and its Mandiant incident response group said the threat actor specializes in attacking edge appliances, gaining long-term access and using the devices to pivot further into a victim's IT environment (see: Mandiant: Chinese Espionage Tool Embedded in US Systems). Successful exploitation of CVE-2026-102764 "allows an unauthenticated remote attacker to perform file operations on the appliance, which can lead to host-level control and access to every credential the appliance stores or brokers," Google researchers warned. "If you run BeyondTrust Remote Support, you should patch ASAP," said Joe Toomey, vice president of underwriting security for cyber insurance provider Coalition. BeyondTrust said it's withholding full details of the vulnerability to give customers time to patch. Toomey said the clock is ticking. "We are now very much in the area of threat actors who will use an LLM to reverse engineer the patched firmware, identify the vulnerability and build a working exploit, and launch a copycat attack that will likely be far broader than the one that Mandiant attributed to Armory Castle," he said. "Any appliance that was reachable from the internet on a vulnerable version during the exploitation window should be treated as potentially compromised until it has been reviewed," it said. BeyondTrust said it first discovered the exploit of CVE-2026-102764 on Sept. 28, hours after "a separate zero-day campaign against another vendor's edge appliances became public, and Mandiant sent us a brief non-specific note that put the team on alert." BeyondTrust's security team contained the compromise, which dated from Aug. 29, and began studying how it worked. The vendor said it runs a third-party attack-detection platform that ingests signals from customer devices and that it detected signs of the attack, but they were labeled as being a false-positive and not flagged for human review. "To strengthen our ability to detect and respond to similar activity in the future, we are working with the vendor to ensure automated triage tools cannot close high-severity signals independently. We are also using our own agentic hunt platforms to reverify external dispositions before closing them," it said. Mandiant also reviewed the compromise of the self-hosted customer and confirmed BeyondTrust's findings on Sept. 30. Mandiant found that after exploiting CVE-2026-102764, the threat actor attempted to dump credentials stored in the appliance's built-in secrets management database - including passwords, API keys, endpoint credentials - and to download documents for network reconnaissance purposes as well as target other endpoints in the victim's environment. "The threat actor used newly identified custom malware, the Sawfly webshell and the Bareclaw tunneller, to interact with the BeyondTrust device. Additionally, the actor routinely deleted appliance logs and endpoint artifacts to maintain access and evade detection," the Google researchers said. They warned that Armory Castle has a history of switching from very targeted exploits of zero-days to mass exploitation, once knowledge of the vulnerabilities becomes public (see: Chinese Espionage Group Targeting Legacy Ivanti VPN Devices). Executive Editor, DataBreachToday & Europe, ISMG Schwartz is an award-winning journalist with two decades of experience in magazines, newspapers and electronic media. He has covered the information security and privacy sector throughout his career. Before joining Information Security Media Group in 2014, where he now serves as the executive editor, DataBreachToday and for European news coverage, Schwartz was the information security beat reporter for InformationWeek and a frequent contributor to DarkReading, among other publications. He lives in Scotland.

Forcepoint and BeyondTrust Connect identity risk to data exposure, letting customers revoke risky access with precision. COMPANY NEWS: New integration pairs Forcepoint's AI-native data discovery and classification with BeyondTrust's identity risk detections, revealing the sensitive data behind each risk and revoking one identity's access while the business keeps running * Connect identity and data risk and act. When BeyondTrust detects a compromised user, a service account with too much access or an AI agent behaving oddly, Forcepoint shows the data at stake, allowing customers to revoke that identity's access. * Prioritise the exposures that matter. BeyondTrust maps the inherited entitlements and shadow paths behind each identity's access. Forcepoint ranks those identities by the value of the data they can touch, putting the riskiest exposure first. * Keep everyone else working. Customers remove a targeted identity's access instead of locking down whole systems. AUSTIN and ATLANTA - Oct. 8, 2026 - Global AI data security leader Forcepoint and BeyondTrust, the global leader in privilege-centric identity security protecting Paths to Privilege(TM), today announced the new integration of Forcepoint's AI-native data discovery and classification with BeyondTrust Identity Security Insights(R). The integration is available now and debuts today at BeyondTrust's Go Beyond Chicago customer conference. When BeyondTrust detects risk across a human, machine or AI identity based on behaviour, privilege or compromised credentials, Forcepoint pinpoints the sensitive information that identity can reach and where exposure is greatest as risk changes. Customers can then use Forcepoint controls to immediately cut off that identity's access to the specific records involved, without affecting anyone else's access or work. "With AI agents now doing real work inside the business, blocking autonomous tools isn't an option, and neither is guessing," said Bakshi Kohli, Chief Technology Officer of Forcepoint. "When BeyondTrust tells us an identity looks risky, we already know what data it can get to. Teams can take that one identity's access away and nothing more. That's the precision agentic enterprises ask for today." Security teams often get an identity alert in one console and have to open another to understand the full risk. The flagged identity could be a forgotten test login or an account that can read the customer database, and telling the two apart means checking both systems by hand, one alert at a time. Every minute of manual review is another minute an overprivileged identity or AI agent keeps acting. Turning Identity Alerts into AI Data Security Action Customers now get the data context behind each identity risk, along with the controls to act on it. BeyondTrust Identity Security Insights(R) surfaces risky identities based on behavior, privilege, compromised credentials and relationships among them. Forcepoint Data Security Posture Management (DSPM), part of the company's AI data security solutions, maps that risk to the confidential information within its permissions and provides controls to restrict that access. Compromised identities. A stolen identity is only as dangerous as the access it provides and the data that access puts in reach. When BeyondTrust detects a compromised identity or entitlement, the True Privilege(TM) graph maps the real blast radius: every path that identity can take to privilege, not just the permissions on paper. Forcepoint shows which sensitive records sit at the end of those paths, from personal data to financial records and trade secrets, and lets teams block that credential's access. Service accounts and AI agents with too much access. Machine and AI identities outnumber human users 144-to-1, according to 2026 research from the Cloud Security Alliance, and many carry permissions that haven't been reviewed since they were granted. If BeyondTrust detects risky behavior or excessive privilege associated with a service account or AI agent, teams can use Forcepoint to revoke its access to the sensitive data at risk in one step. The account keeps doing the rest of its job. Too many alerts, too little context. Instead of cross-checking two consoles, customers work from one Forcepoint dashboard that ranks each risky identity by the value of accessible data and shows why that identity was deemed risky. With a clear line of sight from identity and privilege risk to sensitive data, teams investigate faster, focus on critical vulnerabilities and remove or restrict access with targeted precision. "The strongest technology alliances bring together complementary capabilities to solve problems neither side should have to solve in isolation," said David Manks, Vice President of Global Strategic Alliances at BeyondTrust. "Forcepoint's understanding of sensitive data and BeyondTrust's identity and privilege intelligence provide two critical dimensions of risk. Bringing them together helps customers see where risky access creates meaningful exposure and take precise action to protect what matters." Availability The Forcepoint DSPM integration with BeyondTrust Identity Security Insights is available now for customers running both solutions. Customers can get started through their Forcepoint account team. Forcepoint joins BeyondTrust at Go Beyond Chicago on Oct. 8. For more information, visit https://www.forcepoint.com/partners/beyondtrust or https://www.beyondtrust.com/partners/directory/forcepoint.